
Daily Open Source Infrastructure Report 



Top Stories 

• A Kentucky man who controlled Florida payroll management company 02HR pleaded 
guilty December 23 to engaging in $53 million in tax fraud, defrauding and misleading 
regulators, and conspiring to bribe bank executives. - Reuters (See item 4 ) 

• Authorities are investigating potential sabotage after a Burlington Northern Santa Fe 
Railway train heading southbound from Prineville to Bend, Oregon, struck a rail December 
23 spilling about 2,000 gallons of the train’s diesel fuel. - KTVZ 21 Bend (See item 6) 

• Two former administrators at Sacred Heart Hospital in Chicago pleaded guilty December 
23 for their roles in a massive Medicare and Medicaid kickback fraud scheme. - Chicago 
Tribune (See item 17 ) 

• A tornado that touched down December 23 in Columbia, Mississippi, ki lled 4 people, 
damaged several businesses and homes, prompted the closure of Highway 98, and knocked 
out power to at least 8,000 customers across 3 counties. - WDAM 7 Laurel (See item 25 ) 
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Energy Sector 



1. December 24, Columbus Dispatch - (Ohio) Crews cap gas leak at Monroe County 
fracking well. Crews capped a gas leak and replaced a Triad Hunter-owned natural gas 
well in Monroe County December 23 after the well blew out December 13 prompting 
the evacuation of nearby homes. The Ohio Department of Natural Resources will 
determine when crews can resume after the company originally reported that they were 
working on the well to unplug and prepare it for production when the pressure rose and 
gas poured out. 

Source: http://www.dispatch.com/content/stories/local/2014/12/23/Monroe-Countv- 
officials-reduce-evacation-area-following-fracking-mishap.html 

2. December 23, KTRE 9 Lufkin - (Texas) San Augustine Co. Sheriffs Office arrests 
3rd suspect in oil field theft ring. A third suspect who was allegedly involved in a 
string of oil field thefts in San Augustine County was arrested December 22 by 
sheriffs deputies. The thefts involved as many as 40 oil and gas drill sites that 
impacted 8 companies and netted $26,000, and authorities believe more arrests could 
be made. 

Source: http://www.ktre.com/story/27695770/san-augustine-co-sheriffs-office-arrests- 
3rd-suspect-in-oil-field-thing-ring 

For additional stories, see items 6 and 25 
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Chemical Industry Sector 

Nothing to report 
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Nuclear Reactors, Materials, and Waste Sector 

3. December 23, Associated Press - (Nevada; Tennessee) Nevada agrees to take nuclear 
waste from Tennessee. The State of Nevada and the U.S. Department of Energy 
announced December 23 a deal to allow the burial of low-level radioactive waste from 
the Oak Ridge facility in Tennessee at the Nevada National Security Site. 

Source: http://elkodaily.com/news/nevada-agrees-to-take-nuclear-waste-from- 
tennessee/article 1 c68839b-f37 1 -5ace-ae04-9656d24b740d.html 

[ Return to top ] 

Critical Manufacturing Sector 

Nothing to report 
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Defense Industrial Base Sector 



Nothing to report 
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Financial Services Sector 

4. December 23, Reuters - (National) Kentucky businessman pleads guilty to $53 min 
tax fraud. A Kentucky man who controlled Florida payroll management company 
02HR pleaded guilty December 23 to engaging in $53 million in tax fraud, defrauding 
and misleading regulators, and conspiring to bribe bank executives, charges that 
originated in the investigation of the failed New York-based Park Avenue Bank. The 
bank’s fonner president and senior vice president were previously found guilty on 
fraud charges and an alleged co-defendant is also scheduled to go on trial in March 
2015. 

Source: http://www.reuters.com/article/2014/12/23/usa-crime-tarp- 
idUSL!N0U72 1020141 223 

For another story, see item 29 
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Transportation Systems Sector 

5. December 24, KGNS 8 Laredo - (International) Bomb threat closes bridge number 
two. Both lanes of bridge number two in Laredo were closed going in and out of 
Mexico from the U.S. for several hours December 23 due to a bomb threat which was 
cleared by the Laredo Fire Department. 

Source: http://www.kgns.tv/home/headlines/Bomb-threat-closes-bridge-number-two- 
286771761.html 

6. December 24, KTVZ 21 Bend - (Oregon) Bend train’s diesel fuel spill may be work 
of saboteur. A Burlington Northern Santa Fe Railway train heading southbound from 
Prineville to Bend struck a rail December 23 spilling about 2,000 gallons of the train’s 
diesel fuel which prompted the closing of Revere and Olney avenues crossings and the 
Greenwood Avenue underpass for several hours during cleanup efforts. The railway is 
investigating the incident as a potential act of sabotage. 

Source: http://www.ktvz.com/news/train-diesel-fuel-spill-closes-ne-bend- 
crossings/303725 12 

7. December 23, CBS News; Associated Press - (New York) Southwest jet loses wingtip 
after bumping place at NYC airport. The left winglet of a Southwest Airlines flight 
departing to Denver was ripped off after it made contact with an American Airlines’ 
jet’s left horizontal stabilizer as the plane was taxiing to its gate from Dallas at New 
York’s LaGuardia Airport December 23. The Southwest Airlines plane was taken out 
of service for inspection and repairs and the American Airlines plane was kept in New 
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York for inspection while passengers from both flights were transported to their 
destinations through different flights. 

Source: http://www.cbsnews.com/news/southwest-iet-loses-wingtip-after-bumping- 
plane-at-nyc-airport/ 

8. December 23, Bloomberg News - (National) Philadelphia, New York airline hubs 
cause flight delays to reach 1,500 across the country. About 1,500 flights were 
delayed and 260 were cancelled at U.S. airline hubs in New York and Philadelphia 
December 23 due to fog that caused minimal visibility. 

Source: http://www.mcall.com/news/nationworld/pennsvlvania/mc-pa-philly-airport- 
delays-20141223-story.html 

For another story, see item 25 
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Food and Agriculture Sector 

9. December 23, New Philadelphia Times Reporter - (Ohio) Firefighters called to 
Sugarcreek Township farm. A fire at Twin Fawn Farms in Sugarcreek Township 
December 23 caused an estimated $15,000 in damage to a grain dryer and destroyed 
about 300 bushels of corn worth $1,200. 

Source: 

http://www.timesreporter.com/article/20141223/NEWS/141229717/10675/NEWS 

10. December 23, KXII 12 Sherman - (Texas) Fire scorches Lamar County dairy farm. 
A December 23 fire at Daisy Farms in Lamar County consumed an area of the dairy 
farm and killed eight calves before firefighters contained the blaze. The cause of the 
fire is under investigation. 

Source: http://www.kxii.com/home/headlines/Fire-scorches-Lamar-Countv-dairy-farm- 
-286720411.html 

1 1 . December 23, Associated Press - (Delaware) 11 horses killed in Delaware barn fire, 

1 escapes. Authorities are investigating the source of a barn fire in Yorklyn December 
21 that caused an estimated $60,000 in structural damage and killed 11 horses. 

Source: http://www.wmdt.com/news/more-local-news/ll-horses-killed-in-delaware- 
bam-fire-1 -escapes/30366334 

12. December 23, U.S. Department of Agriculture - (California; Texas) Recall notification 
report 088-2014 (DaBecca Sliced Uncured Apple Smoked Bacon). The Food Safety 
and Inspection Service announced December 23 that Chicago-based DaBecca Natural 
Foods issued a recall for about 3,450 pounds of Sliced Uncured Apple Smoked Bacon 
because the products were packaged and shipped without a label that bears the U.S. 
Department of Agriculture’s mark of inspection despite being produced under 
inspection. The affected products were sent to institutional distributors in California 
and Texas. 

Source: http://www.fsis.usda.gov/wps/portal/fsis/topics/recalls-and-public-health- 
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13. December 23, U.S. Food and Drug Administration - (National) Snoqualmie Gourmet 
Ice Cream, Inc. voluntarily recalls ice cream, gelato, custard and sorbet because of 
possible health risk. The U.S. Food and Drug Administration announced December 23 
that Snoqualmie Gourmet Ice Cream, Inc., recalled all flavors and container sizes of its 
ice cream, gelato, custard, and sorbet produced between January 1 and December 15 
due to possible Listeria monocytogenes contamination. The affected products were 
labeled under the Snoqualmie, Emerald & Spruce, and Top Pot brands and distributed 
and sold in various retail outlets in several States. 

Source: http://www.fda.gov/Safety/Recalls/ucm427940.htm 

14. December 22, U.S. Food and Drug Administration - (Oregon; Washington) Kent, WA 
firm issues allergy alert on undeclared shellfish in Tofu Pad Thai Bowl and Thai 
Noodle Salad. The U.S. Food and Drug Administration reported December 22 that 
Real Foods issued a recall for 299 units of Tofu Pad Thai Bowl and 178 units of Thai 
Noodle Salad products due to undeclared shellfish caused by misbranding. The 
products were sent to retailers in Oregon and Washington. 

Source: http://www.fda.gov/Safety/Recalls/ucm427935.htm 
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Water and Wastewater Systems Sector 

15. December 23, Garner-Cleveland Record - (North Carolina) Johnston pipeline breaks, 
sewage spills into creek. Authorities are investigating after a broken pipeline caused 
13,000 gallons of untreated sewage to spill into an unnamed creek that feeds into the 
Neuse River in Johnston County December 22. 

Source: http://www.garnercleveland.com/2014/12/23/4425030 johnston-pipeline- 
breaks-sewage.html 

16. December 23, KVAL 13 Eugene - (Oregon) High tide causes Coos Bay wastewater 
system to overflow. High tides the weekend of December 20 caused an overflow and 
release of 21,000 gallons of fully treated and disinfected wastewater from a manhole in 
Coos Bay. The overflow stopped once the tide receded and officials reported that the 
wastewater was in full compliance with federal regulations. 

Source: http://www.kval.com/news/local/High-tide-causes-Coos-Bay-wasterwater- 
systemt-to-overflow-286698691.html 

For another story, see item 24 
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Healthcare and Public Health Sector 
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17. December 23, Chicago Tribune - (Illinois) 2 former Sacred Heart Hospital 



executives plead guilty in scheme. Two former administrators at Sacred Heart 
Hospital in Chicago pleaded guilty December 23 for their roles in a massive Medicare 
and Medicaid fraud scheme in which doctor’s referred patients to the hospital in 
exchange for kickbacks, netting tens of thousands of dollars. Eight other doctors and 
hospital executives face charges in the scheme. 

Source: http://www.chicagotribune.com/news/ct-sacred-heart-hospital-fraud-met- 
20141223-story.html 

For another story, see item 25 
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Government Facilities Sector 

18. December 23, Pensacola News Journal - (Florida) Fort Pickens to close due to 
winds, surf. Fort Pickens in Florida was closed December 23 until further notice by the 
Gulf Islands National Seashore due to winds and high surf that could cause low-lying 
sections of Fort Pickens Road to become impassable and over-washed. 

Source: http://www.pni.com/storv/news/local/pensacola/beaches/2014/12/23/fort- 
pickens-close-due- weather/20808725/ 

T Return to top i 

Emergency Services Sector 

19. December 23, Reuters - (Colorado) FBI arrests Colorado man over online threats to 
kill police. A Colorado man was arrested December 22 after posting threats that 
encouraged the killing of police officers on a social media site. The FBI’s San 
Francisco office was alerted by Google representatives December 17 after a user left a 
threatening comment on a YouTube video. 

Source: http://www.msn.com/en-us/news/crime/fbi-arrests-colorado-rnan-over-online- 
threats-to-kill-police/ar-BBh9XwK 
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Information Technology Sector 

20. December 24, Softpedia - (International) Malware families distributed through 
malicious campaign targeting WordPress sites. Researchers with Zscaler identified a 
malware distribution campaign utilizing more than 50 WordPress Web sites used by 
exploit kits as malware drop sites. The researchers observed the Upatre and Hencitor 
malware droppers, Vawtrack (also known as NeverQuest) banking malware, and Extrat 
Xtreme remote access trojan (RAT) among the malware being distributed in the 
campaign. 

Source: http://news.softpedia.com/news/Malware-Families-Distributed-Through- 
Malicious-Campaign-Targeting-WordPress-Sites-468301.shtml 
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21. December 24, The Register - (International) Rackspace restored after DDOS takes 
out DNS. Rackspace stated that it has recovered from a distributed denial of service 
(DDoS) attack that began December 22 and lasted for about 1 1 hours, resulting in some 
legitimate traffic to the company’s DNS infrastructure being blocked. 

Source: 

http://www.theregister.co.uk/2014/12/24/rackspace restored after ddos takes out dns 

/ 

For another story, see item 29 



Internet Alert Dashboard 



To report cyber infrastructure incidents or to request information, please contact US-CERT at soc@us-cert.gov or 
visit their Web site: http://www.us-cert.gov 

Information on IT information sharing and analysis can be found at the IT ISAC (Information Sharing and 
Analysis Center) Web site: http://www.it-isac.org 
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Communications Sector 

Nothing to report 
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Commercial Facilities Sector 

22. December 24, Rochester Post-Bulletin - (Minnesota) Bomb squad determines 
suspicious suitcase not a threat. An apartment complex and nearby buildings in 
downtown Rochester, Minnesota, were evacuated for more than 3 hours December 23 
while authorities investigated a suspicious suitcase that was left propped against a 
natural gas line. The scene was cleared after the St. Paul Bomb Squad determined the 
suitcase was not a threat. 

Source: http://www.postbulletin.com/news/local/bomb-squad-determines-suspicious- 
suitcase-not-a-threat/article 1083433 1 -9eca-5a80-8d87- 1 570 1 2b30bbb.html 

23. December 24, Miami Herald - (Florida) Molotov cocktails hurled into Miami 
Gardens cafeteria. Two Molotov cocktails were thrown into Shorty’s Cafeteria in 
Miami Gardens December 23 during a possible arson attack that rendered the restaurant 
a total loss and damaged adjoining businesses. Police are investigating the incident. 
Source: http://www.miamiherald.com/news/local/community/miami-dade/miami- 
gardens/article49 1 1 648 .html 

24. December 24, WUSA 9 Washington, D.C. - (Washington, D.C.) Road closures for 
water main break on 8th St. in D.C. A 12-inch water main that broke along 8th Street 
in Washington, D.C., December 24 prompted the closure of several businesses and 
restaurants in the area when crews shut off water to repair the line. Authorities reported 
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that repairs will take several hours. 

Source: http://www.wusa9.com/story/news/2014/12/24/water-main-break-8th-street- 
pennsylvania-ave-g-st-dc/20849323/ 

25. December 23, WDAM 7 Laurel - (Mississippi) Devastating tornado rips through 
south Mississippi; 4 dead, many injured. A tornado that touched down December 23 
in Columbia, Mississippi, damaged several businesses and homes, prompted the closure 
of Highway 98, and knocked out power to at least 8,000 customers across Marion, 

Lamar, and Jones counties, including one hospital that was forced to operate off of a 
generator. Four individuals were killed and at least 50 others were injured by the 
tornado. 

Source: http://www.wdam.com/storv/27697479/devastating-tomado-rips-through- 
south-mississippi-4-dead-many- injured 

26. December 23, Atlanta Journal-Constitution - (Georgia) Police searching for gunman 
in Midtown theater shooting. Two patrons sustained minor injuries when a gunman 
opened fire December 23 inside the Landmark Midtown Art Cinema theater in Atlanta 
following an altercation. Police are investigating the incident and working to locate the 
shooter. 

Source: http://www.aic.com/news/news/police-searching-for-gunman-in-midtown- 
theater-sho/njZhS/ 

27. December 23, WCBD 2 Charleston - (South Carolina) Apartment complex evacuated 
after gas leak in North Charleston. About 20 residents were evacuated from the 
Palmetto Rental Apartments in North Charleston for several hours December 23 after a 
semi-truck struck and severed a gas main in the area. Crews worked to contain the leak 
before they cleared the scene and residents could return. 

Source: http://www.counton2.com/storv/27699045/apartment-complex-evacuated- 
after-gas-leak-in-north-charleston 

28. December 23, Reuters - (Florida) Florida police hunt for shooters who injured nine 

on basketball court. Police are searching for 2 suspected gunmen who opened fire 
during a drive-by shooting on a basketball court in suburban Miami December 23 
injuring 9 youths. 

Source: http://www.reuters.com/article/2014/12/23/us-usa-florida-shooting- 
idUSKBN0KllL220141223 

29. December 23, Securityweek - (International) RSA report dives deep into Backoff PoS 
malware. Researchers at EMC’s RSA Security Division released a report analyzing the 
Backoff point of sale (PoS) malware, which found that the malware’s operators may be based 
in India and have used the presence of exposed surveillance cameras to indicate whether a 
potential target was a retail entity, among other findings. 

Source: http://www.securitvweek.com/rsa-report-dives-deep-backoff-pos-malware 

30. December 22, Associated Press - (Pennsylvania) 2 hurt in western Pennsylvania car 
wash explosion. Two individuals were injured at Ducky’s Car Wash in McDonald, 
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Pennsylvania, December 21 when the business’s owner lit a boiler which accidentally 
sparked a natural gas explosion. A mechanical room and two car wash bays were 
destroyed by the explosion. 

Source: http://abcnews.go.com/US/wireStorv/hurt-western-pennsylvania-car-wash- 
explosion-27761485 
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Dams Sector 

Nothing to report 



1 Return to top i 




NTAS 

A^viwfT 

NO ACTIVE ALERTS 
www.DHS.gov/alerts 



Department of Homeland Security (DHS) 
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About the reports - The DHS Daily Open Source Infrastructure Report is a daily [Monday through Friday] 
summary of open-source published information concerning significant critical infrastructure issues. The DHS Daily 
Open Source Infrastructure Report is archived for 10 days on the Department of Homeland Security Web site: 
http://www.dhs.gov/IPDailyReport 

Contact Information 

Content and Suggestions: Send mail to cikr.productfeedback@hq.dhs.gov or contact the DHS 

Daily Report Team at (703) 942-8590 

Subscribe to the Distribution List: Visit the DHS Daily Open Source Infrastructure Report and follow 

instructions to Get e-mail updates when this information changes . 

Removal from Distribution List: Send mail to support @ govdelivery.com . 



Contact DHS 

To report physical infrastructure incidents or to request information, please contact the National Infrastructure 
Coordinating Center at nicc@hq.dhs.gov or (202) 282-9201. 

To report cyber infrastructure incidents or to request information, please contact US -CERT at soc@us-cert.gov or visit 
their Web page at www.us-cert.gov . 

Department of Homeland Security Disclaimer 

The DHS Daily Open Source Infrastructure Report is a non-commercial publication intended to educate and inform 
personnel engaged in infrastructure protection. Further reproduction or redistribution is subject to original copyright 
restrictions. DHS provides no warranty of ownership of the copyright, or accuracy with respect to the original source 
material. 
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